renderFormField on develop is still missing HTML escaping (CVE-2025-30223)

server/web/templatefunc.go, renderFormField() on develop interpolates value directly into HTML attributes via fmt.Sprintf with no escaping:

if isValidForInput(fType) {
    return fmt.Sprintf(`%v<input%v%v name="%v" type="%v" value="%v"%v>`,
        label, id, class, name, fType, value, requiredString)
}
...
return fmt.Sprintf(`%v<%v%v%v name="%v"%v>%v</%v>`,
    label, fType, id, class, name, requiredString, value, fType)

If value contains "><script>...</script><x foo=", it breaks out of the attribute --- straightforward stored XSS through any model field rendered by RenderForm.

Upstream commit 939bb18c ("fix: add proper HTML escaping in renderFormField", CVE-2025-30223) wraps these Sprintfs with template.HTMLEscapeString (and adds tests covering <script>, quote-break, etc.). The fix is on master but not on develop. Either backport the patch or, if develop has been retired, marking it that way explicitly would help downstream consumers.